Analysis
-
max time kernel
156s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00122a4593d136149c83240d1db5aceb.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
00122a4593d136149c83240d1db5aceb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
00122a4593d136149c83240d1db5aceb.exe
-
Size
80KB
-
MD5
00122a4593d136149c83240d1db5aceb
-
SHA1
c37dc9eb929bf8d30f0d74a97a5db6437b7bd31e
-
SHA256
371b4b7c3daf64f2d5e1eb515258f0222f4bf69fbc264a5ee4e83234c5ff0736
-
SHA512
acb06ab5d29eac6baa303583f4d07374f54a786930f560aafb6c5217d41264310c37d587b04277716a83816e3ca51055302fbfe4933c73603fd09e652606e703
-
SSDEEP
1536:vj7wLLiXtvKGlTGQxguIxZTAwlpwFJ0T72mocT:LoLivrKxZfUFJ0T72mBT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 00122a4593d136149c83240d1db5aceb.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeuem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 00122a4593d136149c83240d1db5aceb.exe -
Executes dropped EXE 1 IoCs
pid Process 4920 jeuem.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /d" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /v" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /j" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /y" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /n" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /o" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /s" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /l" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /z" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /h" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /q" 00122a4593d136149c83240d1db5aceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /r" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /g" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /p" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /e" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /u" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /m" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /w" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /c" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /b" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /t" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /a" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /x" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /q" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /f" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /i" jeuem.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeuem = "C:\\Users\\Admin\\jeuem.exe /k" jeuem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4948 00122a4593d136149c83240d1db5aceb.exe 4948 00122a4593d136149c83240d1db5aceb.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe 4920 jeuem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4948 00122a4593d136149c83240d1db5aceb.exe 4920 jeuem.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4920 4948 00122a4593d136149c83240d1db5aceb.exe 90 PID 4948 wrote to memory of 4920 4948 00122a4593d136149c83240d1db5aceb.exe 90 PID 4948 wrote to memory of 4920 4948 00122a4593d136149c83240d1db5aceb.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\00122a4593d136149c83240d1db5aceb.exe"C:\Users\Admin\AppData\Local\Temp\00122a4593d136149c83240d1db5aceb.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\jeuem.exe"C:\Users\Admin\jeuem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5481a93afcbcb87458071b2be22fd0205
SHA189dc767acc548c13b01c2b3c945796550a7b0546
SHA2564906834ed29efabb2488ae468cde4cd714f160400da7134cbfecf7c091a97637
SHA51225e0be55c90992d4c37e266c5d54899aab9b4004ee19b668b2afd78a0795370f1e18c734242e1bef28805aae705918bdabe1c5a29bf1b1de2ae4ba6bf7e1df65